elastic/kibana
[Security Solution][Alerts] Warn users when rule interval is larger than time range searched
Ouverte
#154 963 ouverte le 13 avr. 2023
Feature:DE O11yFeature:Detection AlertsTeam:Detection Engineeringconsider-nexteffort:lowenhancementgood first issuesdh-linkedv8.8.0value:high
Métriques du dépôt
- Stars
- (19 065 étoiles)
- Métriques de merge PR
- (Métriques PR en attente)
Description
Currently it's possible to specify arbitrary values for to, from, and interval in the detection rules APIs. This can lead to scenarios where the difference between to and from is smaller than the rule interval and some time periods will not be searched by the rule. For example, if we have
to: 'now-5m',
from: 'now-7m',
interval: '5m',
then the rule searches a 2 minute time period every 5 minutes. This leaves 3 out of every 5 minutes un-searched. We should add additional validation in rule APIs and/or runtime checks at rule execution time to prevent/warn users about misconfigurations like this.
Related Issues